Terms & policies

Read-only, apart from one change you approve and we remove. A Global Administrator takes three one-time steps, about fifteen minutes in all:

• Approve the assessment application - Glow Cloud Assessment (read-only), through a consent link. It asks only for read permissions, plus one that lets it use the role it is given.
• Give it the Global Reader role - Microsoft’s read-only role, assigned with one short command in Microsoft’s own PowerShell module (the Entra portal cannot assign a directory role to an application).
• Approve our SharePoint sign-in application - through a second approval link. Its consent screen lists broad permissions, including full control of all site collections, because that is the default set requested by the SharePoint PowerShell tooling we use. They are delegated: it acts only with the rights of whoever is signed in to it and holds no standing access of its own. The approval covers your whole tenant, so you delete the application at handover. We use it only to read.

You also create a temporary engagement account with the SharePoint Administrator role. The sign-ins fall hours apart, so we sign in to it ourselves, and you share its password and second factor with us for the engagement window. A run signs in three times: twice early (the tenant-level SharePoint settings, and the scan for content shared with everyone in your organisation) and once near the end (each site’s own permission list, which the permission map is built on). The content crawl runs as the assessment application, with no sign-in.

The one change, only with your written agreement. The SharePoint Administrator role manages SharePoint settings but does not open any site’s contents, and a new account belongs to no site. So before the run we add the engagement account as a site collection administrator on every SharePoint site (not personal OneDrive sites), recording each addition and reading it back. At handover we remove every addition we made, never an access that was there before. Our additions are withheld from your permission map, so our access is never presented as yours. A site that still refuses is named in the report as not read, never guessed.

At handover we remove our additions first; you then disable or delete the engagement account, delete both applications and remove the Global Reader assignment. After that nothing of ours remains in your tenant. Every sign-in by both applications and by the engagement account appears in your Entra sign-in logs, and our additions and removals appear in your unified audit log.

On a retainer the read-only assessment application stays approved, with its read-only Global Reader role, between cycles, because the scheduled quarterly run needs it. The SharePoint sign-in application, the engagement account and our site collection administrator additions are set up and removed again each cycle, and the stages that need a signed-in administrator run attended. For a one-off engagement the handover order above is unchanged.

The fallback, if you cannot allow the change: an existing account that already belongs to most sites - your SharePoint administrator, or your managed-service provider’s - signs in instead, over a screen share or with temporary credentials. No change is made by default: coverage is whatever that account can open, sites it cannot open are named in the report as not read, and with your written agreement a targeted addition on just those sites can follow, removed again at handover. Your administrator signs in at each of the three points - twice at the start of the run and once hours later, near the end. If they are not available for the last one, that stage runs without it and the map is shallower.

Fabric / Power BI checks are optional: a read-only admin-API setting in your Fabric portal, plus adding our assessment application to a security group you control. That setting and group are yours, not a change we make; at handover switch the setting off again, or remove our application from the group. Skip it and the assessment still runs, with those checks clearly marked "requires consent" in your report, never silently missing and never guessed. Without the engagement account the assessment also still runs, but the tenant-level SharePoint settings and the scan for content shared with everyone are reported as not assessed, and the permission map shows access rolled up to the site rather than down to the library - a shallower map that can overstate reach. We will say so at the readout. Nothing is scored against you for access you chose not to grant. And the price is the price: full coverage costs nothing extra - the only thing gating your report is what you choose to grant.